F5 BIG-IP Management Interface Perl Injection

2009-03-17 / 2009-03-18
Credit: nnposter
Risk: High
Local: No
Remote: Yes
CWE: CWE-94


Ogólna skala CVSS: 9/10
Znaczenie: 10/10
Łatwość wykorzystania: 8/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Jednorazowa
Wpływ na poufność: Pełny
Wpływ na integralność: Pełny
Wpływ na dostępność: Pełny

F5 BIG-IP Management Interface Perl Injection Product: F5 BIG-IP http://www.f5.com/products/big-ip/ The F5 BIG-IP reconfiguration facility, used by both the web management interface and the CLI, suffers from insufficient input validation and/or sanitization of certain reconfiguration requests. It is possible for a logged-in user with Resource Manager or Administrator privileges to inject arbitrary Perl code, including spawning Unix shell commands, that gets immediately executed with root privileges. (For the Administrator role this does not provide any new privileges because it is already provided with full shell access as root.) The core of the problem is using Perl EP3 with templates containing substitutions similar to $val='NEW_VALUE'; without first escaping single quotes in NEW_VALUE; As an example, the SNMP community string configuration accepts the following value as an allowed source of SNMP requests: "none'.`touch /etc/foo`.'" It is possible to craft URL links that would inject the code with a simple HTTP GET request. Cross-site attacks may leverage this vulnerability to make an arbitrary change to the BIG-IP appliance. The vulnerability has been identified in version 9.4.3. However, other versions may be also affected. Found by: nnposter


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top